mirror of
https://github.com/LostCityRS/Engine-TS
synced 2026-08-16 08:26:04 -04:00
143ff378c5
* feat(engine): add CSRF protection setting - New option in `.env`: `WEB_CSRF_PROTECT` Enabling this option will embed a token cookie into the rs2.cgi page which is sent automatically (no client edit) through the WebSocket connection. The server will check this value (only if the option is enabled) against the one it knows for the current deployment. The token value itself is the sha1sum of both the public RSA's modulus and exponents, combined with the system's hostname. This has desirable properties of being deterministic for the same release on the same server. It is resilient to minor hotfixes to the server (so long as the RSA isn't rotated). This ensures that connections to the game's WebSocket have at least visited the game's webpage to have the correct cookie value. * fix(engine): only include current domain for cookie This is important to ensure the cookie is not set for all subdomains of lostcity.rs; otherwise, one tab in a different world might interfere with another. Using window.location.hostname will ensure this. * fix(engine): rename csrf -> token_protection It's not really CSRF anyway. * fix(engine): update example .env --------- Co-authored-by: sentientflare <179689881+sentientflare@users.noreply.github.com> |
||
|---|---|---|
| .. | ||
| private.pem | ||
| public.pem | ||